๐Ÿ‰ Simple WireGuard proxy with minimal overhead for WireGuard traffic.

swgp-go

Go Reference Test Release AUR version AUR version

๐Ÿ‰ Simple WireGuard proxy with minimal overhead for WireGuard traffic.

Proxy Modes

1. Zero overhead

Simply AES encrypt the first 16 bytes of all packets. Handshake packets (message type 1, 2, 3) are also randomly padded to look like normal traffic.

2. Paranoid

Pad all types of packets without exceeding MTU, then XChaCha20-Poly1305 encrypt the whole packet. We pad data packets because:

  • The length of a WireGuard data packet is always a multiple of 16.
  • Many IPv6 websites cap their outgoing MTU to 1280 for maximum compatibility.

Example Config

Make sure to use the right MTU for both server and client. To encourage correct use, swgp-go disables IP fragmentation and drops packets that are bigger than expected.

{
    "interfaces": [
        {
            "name": "wg0",
            "proxyListen": "[::]:20220",
            "proxyMode": "zero-overhead",
            "proxyPSK": "sAe5RvzLJ3Q0Ll88QRM1N01dYk83Q4y0rXMP1i4rDmI=",
            "proxyFwmark": 0,
            "wgEndpoint": "[::1]:20221",
            "wgFwmark": 0,
            "mtu": 1500,
            "disableSendmmsg": false
        }
    ],
    "peers": [
        {
            "name": "laptop",
            "wgListen": "[::]:20222",
            "wgFwmark": 0,
            "proxyEndpoint": "[2001:db8:1f74:3c86:aef9:a75:5d2a:425e]:20220",
            "proxyMode": "zero-overhead",
            "proxyPSK": "sAe5RvzLJ3Q0Ll88QRM1N01dYk83Q4y0rXMP1i4rDmI=",
            "proxyFwmark": 0,
            "mtu": 1500,
            "disableSendmmsg": false
        }
    ]
}

License

AGPLv3

Owner
๐Ÿ‘จโ€๐Ÿ’ป๐Ÿณโ€๐ŸŒˆ๐ŸŒŽ Use Arch Linux. Also the guy who puts emojis in every commit message. He/him. GPG key: 1CA27546BEDB8B01
null
Comments
  • Question about MTU

    Question about MTU

    Hello Thanks for the project! I do have a small question about MTU. My MTU values are like this:

    • Server Internet: 1500
    • Home Internet: 1500
    • Server's Wireguard Interface: 1420
    • Both swgp-go's: 1500 With this setup, Wireguard connects to internet however, I get this warning on my client's swgp-go and the speed is terrible:
    2022-11-18T07:44:34.763+0330 WARN service/client.go:353 Failed to write swgpPacket to proxyConn {"client": "client", "wgListen": "127.0.0.1:20222", "clientAddress": "127.0.0.1:54883", "proxyAddress": "X.X.X.X:Y", "error": "write udp [::]:55084->X.X.X.X:Y: wsasendto: A message sent on a datagram socket was larger than the internal message buffer or some other network limit, or the buffer used to receive a datagram into was smaller than the datagram itself."}
    

    Server acknowledges the new UDP session and there is no log afterwards.

    My server is Ubuntu 22 and my PC is Windows 10. I also use the zero overhead mode.

    I'd be glad if you could help me. Thanks

  • OpnSense/FreeBSD support?

    OpnSense/FreeBSD support?

    Hello there,

    I try to set up wireguard over shadowsocks my opnsense firewall, but no luck... Now found this project and it is very interisting! It possible to use it with freebsd based system, like OPNsense?

  • document issue: proxyPSK is 32 random bytes in base64?

    document issue: proxyPSK is 32 random bytes in base64?

    func NewZeroOverheadHandler(psk []byte) (Handler, error) {
    	cb, err := aes.NewCipher(psk)
    	if err != nil {
    		return nil, err
    	}
    
    	aead, err := chacha20poly1305.NewX(psk)
    	if err != nil {
    		return nil, err
    	}
    

    so seems psk is 32 bytes, AES-256 is selected.

    simple generator:

    python3 -c 'import os,base64; print(base64.b64encode(os.urandom(32)).decode("ascii"))'
    
  • no info on how to setup

    no info on how to setup

    my wg server on ubuntu was working well until the country decide to activate the dpi.now it s impossible to get wireguard get working. i have windows and android in client side. can you provide a step by step guide so it can help people wich are in my case as well

    thank you for your time

  • Proxy in TCP mode + documentation is not enough!

    Proxy in TCP mode + documentation is not enough!

    Hello, In some ISP's or countries most UDP connection ports are blocked. can you please develop proxy in TCP mode? also i can't understand how to integrate proxy config with wireguard? can you please explain about config for clients and config for servers? you send only one sample config and i don't know this is for server only or client only or may seprate to using each other?

  • ๐Ÿ”ผ Update module go to 1.19 - autoclosed

    ๐Ÿ”ผ Update module go to 1.19 - autoclosed

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | go (source) | golang | minor | 1.18 -> 1.19 |


    Release Notes

    golang/go

    v1.19.0


    Configuration

    ๐Ÿ“… Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    ๐Ÿšฆ Automerge: Disabled by config. Please merge this manually once you are satisfied.

    โ™ป Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    ๐Ÿ”• Ignore: Close this PR and you won't be reminded about this update again.


    • [ ] If you want to rebase/retry this PR, click this checkbox.

    This PR has been generated by Mend Renovate. View repository job log here.

  • ๐Ÿ”ผ Update golang.org/x/sys digest to 2296e01

    ๐Ÿ”ผ Update golang.org/x/sys digest to 2296e01

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | golang.org/x/sys | require | digest | 5a39038 -> 2296e01 |


    Configuration

    ๐Ÿ“… Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    ๐Ÿšฆ Automerge: Enabled.

    โ™ป Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    ๐Ÿ”• Ignore: Close this PR and you won't be reminded about this update again.


    • [ ] If you want to rebase/retry this PR, click this checkbox.

    This PR has been generated by Mend Renovate. View repository job log here.

  • ๐Ÿ”ผ Update module go.uber.org/zap to v1.22.0 - autoclosed

    ๐Ÿ”ผ Update module go.uber.org/zap to v1.22.0 - autoclosed

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | go.uber.org/zap | require | minor | v1.21.0 -> v1.22.0 |


    Release Notes

    uber-go/zap

    v1.22.0

    Compare Source

    Enhancements:

    • #โ€‹1071: Add zap.Objects and zap.ObjectValues field constructors to log arrays of objects. With these two constructors, you don't need to implement zapcore.ArrayMarshaler for use with zap.Array if those objects implement zapcore.ObjectMarshaler.
    • #โ€‹1079: Add SugaredLogger.WithOptions to build a copy of an existing SugaredLogger with the provided options applied.
    • #โ€‹1080: Add *ln variants to SugaredLogger for each log level. These functions provide a string joining behavior similar to fmt.Println.
    • #โ€‹1088: Add zap.WithFatalHook option to control the behavior of the logger for Fatal-level log entries. This defaults to exiting the program.
    • #โ€‹1108: Add a zap.Must function that you can use with NewProduction or NewDevelopment to panic if the system was unable to build the logger.
    • #โ€‹1118: Add a Logger.Log method that allows specifying the log level for a statement dynamically.

    Thanks to @โ€‹cardil, @โ€‹craigpastro, @โ€‹sashamelentyev, @โ€‹shota3506, and @โ€‹zhupeijun for their contributions to this release.


    Configuration

    ๐Ÿ“… Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    ๐Ÿšฆ Automerge: Disabled by config. Please merge this manually once you are satisfied.

    โ™ป Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    ๐Ÿ”• Ignore: Close this PR and you won't be reminded about this update again.


    • [ ] If you want to rebase/retry this PR, click this checkbox.

    This PR has been generated by Mend Renovate. View repository job log here.

  • ๐Ÿ”ผ Update golang.org/x/crypto digest to 630584e - autoclosed

    ๐Ÿ”ผ Update golang.org/x/crypto digest to 630584e - autoclosed

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | golang.org/x/crypto | require | digest | 0559593 -> 630584e |


    Configuration

    ๐Ÿ“… Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    ๐Ÿšฆ Automerge: Disabled by config. Please merge this manually once you are satisfied.

    โ™ป Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    ๐Ÿ”• Ignore: Close this PR and you won't be reminded about this update again.


    • [ ] If you want to rebase/retry this PR, click this checkbox.

    This PR has been generated by Mend Renovate. View repository job log here.

  • ๐Ÿ”ผ Update golang.org/x/sys digest to fbc7d0a

    ๐Ÿ”ผ Update golang.org/x/sys digest to fbc7d0a

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | golang.org/x/sys | require | digest | 1c4a2a7 -> fbc7d0a |


    Configuration

    ๐Ÿ“… Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    ๐Ÿšฆ Automerge: Enabled.

    โ™ป Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    ๐Ÿ”• Ignore: Close this PR and you won't be reminded about this update again.


    • [ ] If you want to rebase/retry this PR, click this checkbox.

    This PR has been generated by Mend Renovate. View repository job log here.

  • ๐Ÿ”ผ Update golang.org/x/crypto digest to 0559593

    ๐Ÿ”ผ Update golang.org/x/crypto digest to 0559593

    Mend Renovate

    This PR contains the following updates:

    | Package | Type | Update | Change | |---|---|---|---| | golang.org/x/crypto | require | digest | 793ad66 -> 0559593 |


    Configuration

    ๐Ÿ“… Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

    ๐Ÿšฆ Automerge: Disabled by config. Please merge this manually once you are satisfied.

    โ™ป Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

    ๐Ÿ”• Ignore: Close this PR and you won't be reminded about this update again.


    • [ ] If you want to rebase/retry this PR, click this checkbox.

    This PR has been generated by Mend Renovate. View repository job log here.

  • About disallow unknown fields

    About disallow unknown fields

    Hi, thank you for your outstanding work.

    Regarding the disallow unknown fields in config under this commit c9ba810585243590329a44df2a7d24644f7c6ae1 , could you change it to just prompt a warn than throwing a fetal error when encountering an unknown field?

    I usually write some notes in json using the unknown fields, like below, and now they are all unavailable.

    {
        "interfaces": [
            {
                "Note1": "This is my wireguard server.",
                "name": "wg1",
                "proxyListen": "0.0.0.0:8444",
                "proxyMode": "zero-overhead",
                "proxyPSK": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa=",
                "proxyFwmark": 0,
                "wgEndpoint": "127.0.0.1:8443",
                "wgFwmark": 0,
                "mtu": 1492,
                "batchMode": ""
            }
        ],
        "peers": [
            {
                "Note1": "This is my note.",
                "Note2": "This peer was peer to somewhere",
                "name": "name",
                "wgListen": "0.0.0.0:20222",
                "wgFwmark": 0,
                "proxyEndpoint": "1.1.1.1:4444",
                "proxyMode": "zero-overhead",
                "proxyPSK": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa=",
                "proxyFwmark": 0,
                "mtu": 1492,
                "batchMode": ""
            }
        ]
    }
    

    Or is it possible to support a more human readable format like jsonc(json with comment) or toml?

  • Dependency Dashboard

    Dependency Dashboard

    This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

    This repository currently has no open or pending branches.

    Detected dependencies

    github-actions
    .github/workflows/release.yml
    • svenstaro/upload-release-action v2
    .github/workflows/test.yml
    • actions/checkout v3
    • actions/setup-go v3
    • actions/upload-artifact v3
    gomod
    go.mod
    • go 1.19
    • go.uber.org/zap v1.24.0
    • golang.org/x/crypto v0.4.0
    • golang.org/x/sys v0.3.0

    • [ ] Check this box to trigger a request for Renovate to run again on this repository
A minimal analytics package to start collecting traffic data without client dependencies.

go-web-analytics A minimal analytics package to start collecting traffic data without client dependencies. Logging incoming requests import "github.co

Nov 23, 2021
Simple TCP proxy to visualise NATS client/server traffic
Simple TCP proxy to visualise NATS client/server traffic

NATS uses a simple publish/subscribe style plain-text protocol to communicate between a NATS Server and its clients. Whilst this connection should remain opaque to the user, it can be quite handy to see the data being passed from time to time - this tool does just that (it also saves me loading Wireshark and filtering the NATS traffic).

Jan 15, 2022
Swiss Army knife Proxy tool for HTTP/HTTPS traffic capture, manipulation, and replay on the go.
Swiss Army knife Proxy tool for HTTP/HTTPS traffic capture, manipulation, and replay on the go.

Features โ€ข Installation โ€ข Usage โ€ข Running Proxify โ€ข Installing SSL Certificate โ€ข Applications of Proxify โ€ข Join Discord Swiss Army Knife Proxy for rap

Jan 8, 2023
Reverse proxy server to filter traffic based on JA3 fingerprint/hash

JA3RP (JA3 Reverse Proxy) Ja3RP is a basic reverse proxy server that filters traffic based on JA3 fingerprints. It can also operate as a regular HTTP

Sep 17, 2022
[WIP] gg is a portable tool to redirect the traffic of a given program to your modern proxy without installing any other programs.

gg gg (go-graft), was inspired by graftcp. go-graft is a pure golang implementation with more useful features. TODO: Use system DNS as the fallback. R

Dec 28, 2022
A HTTP proxy server tunnelling through wireguard

wg-http-proxy This project hacks together the excellent https://github.com/elazarl/goproxy and https://git.zx2c4.com/wireguard-go into an HTTP proxy s

Dec 30, 2022
A simple network analyzer that capture http network traffic
A simple network analyzer that capture http network traffic

httpcap A simple network analyzer that captures http network traffic. support Windows/MacOS/Linux/OpenWrt(x64) https only capture clienthello colorful

Oct 25, 2022
A simple tool to convert socket5 proxy protocol to http proxy protocol

Socket5 to HTTP ่ฟ™ๆ˜ฏไธ€ไธช่ถ…็ฎ€ๅ•็š„ Socket5 ไปฃ็†่ฝฌๆขๆˆ HTTP ไปฃ็†็š„ๅฐๅทฅๅ…ทใ€‚ ๅฆ‚ไฝ•ๅฎ‰่ฃ…๏ผŸ Golang ็”จๆˆท # Required Go 1.17+ go install github.com/mritd/s2h@master Docker ็”จๆˆท docker pull m

Jan 2, 2023
Tcp-proxy - A dead simple reverse proxy server.

tcp-proxy A proxy that forwords from a host to another. Building go build -ldflags="-X 'main.Version=$(git describe --tags $(git rev-list --tags --max

Jan 2, 2022
A fork of the simple WireGuard VPN server GUI community maintained
A fork of the simple WireGuard VPN server GUI community maintained

Subspace - A simple WireGuard VPN server GUI Subspace - A simple WireGuard VPN server GUI Slack Screenshots Features Contributing Setup 1. Get a serve

Dec 25, 2022
Simple Web based configuration generator for WireGuard. Demo:
Simple Web based configuration generator for WireGuard. Demo:

Wg Gen Web Simple Web based configuration generator for WireGuard. Why another one ? All WireGuard UI implementations are trying to manage the service

Jan 1, 2023
The Akita CLI for watching network traffic, automatically generating API specs, and diffing API specs.

Catch breaking changes faster Akita builds models of your APIs to help you: Catch breaking changes on every pull request, including added/removed endp

Jan 2, 2023
Transfer 10Gbps http traffic over 1Gbps networks :)

httpteleport Teleports 10Gbps http traffic over 1Gbps networks. Built on top of fastrpc. Use cases httpteleport may significantly reduce inter-server

Nov 30, 2022
Reducing Malloc/Free traffic to cgo

CGOAlloc Reducing Malloc/Free traffic to cgo Why? Cgo overhead is a little higher than many are comfortable with (at the time of this writing, a simpl

Dec 24, 2022
Apache Traffic Control is an Open Source implementation of a Content Delivery Network

Apache Traffic Control Apache Traffic Control is an Open Source implementation of a Content Delivery Network. Documentation Intro CDN Basics Traffic C

Jan 6, 2023
Schema-free, document-oriented streaming database that optimized for monitoring network traffic in real-time

Basenine Schema-free, document-oriented streaming database that optimized for monitoring network traffic in real-time. Featured Aspects Has the fastes

Nov 2, 2022
Serve traffic (HTTP/gRPC) over SSH using Domain Sockets

Serve On SSH Introduction There is often a need to offer services for administrative purposes on servers or even for microservices that are running on

Nov 10, 2022